Hermes
23f636a501
build / build (push) Failing after 13s
- Dockerfile: fetches pinned upstream release binary (static Go) from grafana/mcp-grafana GitHub releases, sha256-verified against the release's own checksums file, runs from scratch. - Workflow: push-to-main / weekly Mon 06:00 UTC / manual dispatch; resolves newest release, skips if tag published, pushes gitea.williammiceli.systems/hermes/grafana-mcp:v<ver> + :latest. - REGISTRY_TOKEN repo Actions secret already provisioned.
50 lines
2.3 KiB
Markdown
50 lines
2.3 KiB
Markdown
# grafana-mcp
|
|
|
|
[Grafana's official MCP server](https://github.com/grafana/mcp-grafana)
|
|
(`mcp-grafana`) packaged as a container image for cluster0, served over
|
|
streamable-HTTP so the Hermes agent (namespace `ai-0`) can call it as an
|
|
HTTP MCP server.
|
|
|
|
## What's in this repo
|
|
|
|
| File | Purpose |
|
|
|---|---|
|
|
| `Dockerfile` | Multi-stage: fetches the pinned upstream release binary from GitHub (sha256-verified against the release's own checksums file) and copies it into `scratch` (the binary is fully static). |
|
|
| `.gitea/workflows/build.yaml` | Builds + pushes `gitea.williammiceli.systems/hermes/grafana-mcp:v<version>` (+ `latest`). Triggers: push to main, **weekly Mon 06:00 UTC** (lands before the cluster0 image-update cron at Mon 13:00 UTC), and manual dispatch. Skips if the tag already exists. |
|
|
|
|
The upstream version is pinned via the `MCP_GRAFANA_VERSION` build-arg
|
|
(default `v1.1.0`); the workflow resolves the newest GitHub release and
|
|
skips the build when it's already published.
|
|
|
|
## Deployment (cluster0)
|
|
|
|
Manifests: `William/Kubernetes_Cluster0`, app dir
|
|
`cluster0 (Personal)/#active/#applications/ai-0 (Hermes Agent)/ai-0-1 (Grafana MCP)/`,
|
|
namespace `ai-0-1`.
|
|
|
|
Runtime env (set by the Deployment, from the server's own Infisical-managed
|
|
secret — never baked into the image):
|
|
|
|
| Var | Value |
|
|
|---|---|
|
|
| `GRAFANA_URL` | `http://grafana-service.personal-0.svc.cluster.local` |
|
|
| `GRAFANA_SERVICE_ACCOUNT_TOKEN` | Grafana service-account token (Infisical project `ai-0-1`) |
|
|
| `ALLOWED_HOSTS` (Deployment env, read by args) | `grafana-mcp-service.ai-0-1.svc.cluster.local` |
|
|
|
|
The service is **ClusterIP-only** (no Ingress/NodePort): it exposes Will's
|
|
Grafana instance, so only in-cluster consumers can reach it. Hermes consumes
|
|
it via `http://grafana-mcp-service.ai-0-1.svc.cluster.local:3000/mcp`.
|
|
|
|
### Grafana service account
|
|
|
|
Create in Grafana (Administration → Service Accounts) with the **Editor**
|
|
built-in role (upstream-recommended quick setup; covers all read + most
|
|
write tools) or granular RBAC scopes, then add a token and store it as
|
|
`GRAFANA_SERVICE_ACCOUNT_TOKEN` in Infisical project `ai-0-1` (env `prod`).
|
|
|
|
## Registry auth for pushes
|
|
|
|
The workflow uses a scoped PAT (`write:package`) stored as repo Actions
|
|
secret `REGISTRY_TOKEN` — Gitea's container registry rejects scoped token
|
|
requests from the Actions job token (upstream #23642).
|